Help

BI’s Article search uses Boolean search capabilities. If you are not familiar with these principles, here are some quick tips.

To search specifically for more than one word, put the search term in quotation marks. For example, “workers compensation”. This will limit your search to that combination of words.

To search for a combination of terms, use quotations and the & symbol. For example, “hurricane” & “loss”.

Login Register Subscribe

Medical device firm releases cyber updates for heart monitors after probe

Reprints
Medical device firm releases cyber updates for heart monitors after probe

(Reuters) — Abbott Laboratories is releasing cyber security updates for its St. Jude heart devices, it said on Monday, some five months after the U.S. government launched a probe into claims they were vulnerable to potentially life-threatening hacks.

The Department of Homeland Security's Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) said the fix does not address all known problems affecting the company's implanted heart devices.

"St. Jude Medical is continuing to work with ICS-CERT and the FDA to address additional security issues that have been identified," the agency said in an advisory on its website.

Representatives for ICS-CERT, the Food and Drug Administration and Abbott could not be reached immediately to comment on the remaining problems.

ICS-CERT issued its advisory after the FDA released a Safety Communication advising patients and physicians that they could continue to using St. Jude's implanted cardiac devices following the updates. ICS-CERT is charged with improving security of technologies in healthcare, energy and other industries that are part of critical infrastructure.

The FDA confirmed claims that cyber "vulnerabilities" could allow a hacker to remotely access St. Jude medical devices, but said there have been no reports of patients harmed by the vulnerabilities.

The updates will automatically be pushed out to St. Jude home monitors that enable doctors to track their performance.

Doctors and patients have been waiting for the FDA and St. Jude to act since August when short-selling firm Muddy Waters and cyber security firm MedSec Holdings claimed the implanted heart devices were riddled with potentially lethal security bugs.

They warned of two primary hacks: One that could cause implanted devices to pace at potentially dangerous rates and one that drains the batteries.

The FDA said it will continue to assess new information concerning the devices and alert the public if it recommends further changes.

"The FDA conducted an assessment of the benefits and risks of using the Merlin@home Transmitter, and has determined that the health benefits to patients from continued use of the device outweigh the cybersecurity risks," the agency said.

Merlin is used with its implantable pacemakers and defibrillator devices.

When Muddy Waters went public with the allegations in August, it also disclosed it was shorting St. Jude Medical, which was preparing to sell itself to Abbott.

Muddy Waters said it believed that disclosure of the vulnerabilities could cause the $25 billion deal to fall apart, but Abbott last week completed its acquisition of St. Jude, one of the world's biggest makers of implantable cardiac devices.

 

 

Read Next

  • St. Jude settles over heart devices

    (Reuters) — St. Jude Medical Inc. has reached a $39.25 million class action settlement with shareholders to resolve claims it downplayed the possible dangers associated with a product used to connect implantable defibrillators to patients' hearts.